Closed shpendk closed 3 years ago
Did a quick run-through on testing the newly implemented run_vuln_checks_from_open_ports()
functionality and how its inference would work.
Here is a quick summary of the tests I performed:
Fantastic work 🔥 as run_vuln_checks_from_open_ports()
now opens up the possibilities of implementing new types of checks an example being checking whether a server running RMI is vulnerable to deserialization (pre-JEP 290).
This PR was supposed to just be a check for Azure's RCE
CVE-2021-38647
. However, because we don't have a fingerprint (and we won't be able to create one from what I could gather) and the issue is on a custom port, i created support for running checks against open ports. The basic idea is this:affected_software
on an Issue, you can defineaffected_ports
affected_ports
is an array of protocol/port combinationsaffected_ports
is matched with the open port on the NetworkService entity.I reckon this enables us to have more checks where an open port is enough for us to fire the check. Of course it would be ideal to fingerprint the service on said open port, but as in this case that's not always possible.
Ps: Typhoeus was failing to connect via https to the target, which is why i swapped
libcurl4-gnutls-dev
withlibcurl4-openssl-dev
. This works and from what I could tell doesn't affect other TSL connections.